Cyber Incident Victim: Reproductive Medicine and Infertility Associates
Date:
Dec 2018
Location:
United States of America
Summary
A Minnesota-based infertility clinic experienced a malware attack compromising patient and donor information, including names, addresses, dates of birth, health insurance details, treatment records, and Social Security numbers specifically for donors. The organization detected the intrusion, engaged forensic experts to remove the malware and investigate potential data access, and stated no evidence of actual or attempted misuse of the exposed information had been identified.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Reproductive Medicine and Infertility Associates (RMIA), a fertility clinic based in Woodbury, Minnesota, discovered malware on its systems on December 5, 2018. The clinic engaged computer forensics specialists to remove the malicious software and investigate the incident’s origin and potential impacts. Forensic analysis aimed to determine whether unauthorized parties accessed or exfiltrated data during the breach window. RMIA publicly disclosed the incident nearly two months later on February 1, 2019, through a press release posted to its website. The announcement clarified that while malware compromised system security, investigators found no evidence of actual or attempted misuse of patient information resulting from the intrusion.
The investigation revealed that exposed information included patient names, physical addresses, dates of birth, health insurance details, and treatment-related records. Social Security numbers were only compromised for donor individuals, not general patients. RMIA initiated direct notifications to affected clients following forensic review. The clinic established a dedicated call center to address patient inquiries about the breach and offered complimentary credit monitoring services specifically to donors whose Social Security numbers were potentially accessed. Organizational response measures focused on containment through malware eradication and external forensic support, with no public disclosure of technical details regarding the malware variant, initial attack vector, or total number of affected individuals.